# Container seal, warranty serial and DNS fingerprint services

## Container Seal Replacement Trace

Compare a container’s removed and installed seals with its replacement authorizations and final seal reading. Supply sourceRevision, containerId, initialSealId, finalObservedSealId and up to 64 entries each in authorizations and observations. Each authorization has id, expectedRemovedSealId and expectedInstalledSealId. Each observation has id, authorizationId, removedSealId and installedSealId. IDs are case-sensitive and use 1 to 48 ASCII letters, digits, underscores, periods, colons, pipes or hyphens. Authorization IDs and observation IDs are unique within their respective lists. Enter observations in physical replacement order and supply authorizations in any order. Every observation advances the reported seal even if an authorization or continuity check fails. The report shows whether the final observation agrees with that trace and whether all checks reconcile. Findings describe supplied records and do not certify container integrity or the validity of an authorization. Use authorized, non-sensitive data. The report describes supplied records and does not change external systems.

[Request example](container-seal-replacement-trace.request.example.json) · [Input schema](container-seal-replacement-trace.input.schema.json) · [Result schema](container-seal-replacement-trace.result.schema.json)

## Warranty Replacement Serial Chain

Trace a warranty asset’s recorded unit replacements from the original serial to the serial you observe today. Supply sourceRevision, assetId, original with serialId and installDate, and currentObservation with serialId and observedDate. Supply up to 64 replacements in any order. Each has a unique id, removedSerialId, installedSerialId and replacementDate. IDs are case-sensitive and use 1 to 48 ASCII letters, digits, underscores, periods, colons, pipes or hyphens. Dates are calendar dates written YYYY-MM-DD. The observation date must be on or after the original installation date. The trace follows a single replacement at each serial, within the supplied dates, without reusing serials. Same-day replacements follow their serial links. The report stops at ambiguous links, lists unlinked replacements, and compares the reached serial with the observed one. It describes the supplied unit history and does not determine warranty coverage. Use authorized, non-sensitive data. The report describes supplied records and does not change external systems.

[Request example](warranty-replacement-serial-chain.request.example.json) · [Input schema](warranty-replacement-serial-chain.input.schema.json) · [Result schema](warranty-replacement-serial-chain.result.schema.json)

## DNS TLSA RDATA Encoder

Encode one TLSA RDATA from a precomputed certificate association digest. Use certificate usage 0–3 and selector 0 for the full certificate or 1 for SubjectPublicKeyInfo. Matching type 1 requires 64 hexadecimal characters for SHA-256 and type 2 requires 128 for SHA-512. The encoder accepts either letter case in contiguous hexadecimal and returns lowercase RDATA hex and its byte length. Supply the digest for the selected certificate data. The encoder works entirely from the supplied fields. Use authorized, non-sensitive data. The report describes supplied records and does not change external systems.

[Request example](dns-tlsa-rdata-encoder.request.example.json) · [Input schema](dns-tlsa-rdata-encoder.input.schema.json) · [Result schema](dns-tlsa-rdata-encoder.result.schema.json)

## DNS SSHFP RDATA Encoder

Encode one SSHFP RDATA from a precomputed SSH public host key fingerprint. Use algorithm 1 for RSA, 2 for DSA, 3 for ECDSA, 4 for Ed25519 or 6 for Ed448. Fingerprint type 1 requires 40 hexadecimal characters for SHA-1 and type 2 requires 64 for SHA-256. The encoder accepts either letter case in contiguous hexadecimal and returns lowercase RDATA hex and its byte length. Supply a DNS-format hexadecimal fingerprint. The encoder works entirely from the supplied fields. Use authorized, non-sensitive data. The report describes supplied records and does not change external systems.

[Request example](dns-sshfp-rdata-encoder.request.example.json) · [Input schema](dns-sshfp-rdata-encoder.input.schema.json) · [Result schema](dns-sshfp-rdata-encoder.result.schema.json)

One-time job. See the exact service price before checkout. Save your private JSON result within its 30-day access period.
Requests accept at most 36,000 UTF-8 input bytes. Send only authorized, non-sensitive records.

For a known hosted offer, read current checkout and wallet availability with `GET https://gatewayinformationgroup.com/api/catalog/v1/search?id=PRODUCT_ID`. Then use the input schema and request example above.

Use the existing [agent checkout guide](https://gatewayinformationgroup.com/developers) to prepare a quote, pay and retrieve the private result.